Improper Filename Validation

2023-07-2717:03:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

thunderbird

vulnerability

filename

validation

executable file

unicode

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

20.4%

JSON

Thunderbird is vulnerable to Improper Filename Validation. the vulnerability is due to a lack of preventing text direction override unicode characters in filename attachments. This can allow an attacker to attach an executable file, without the extension displayed as such.

CPENameOperatorVersion
thunderbird:sideq1:78.5.0-1
thunderbird:bullseyeeq1:78.5.0-1
thunderbird:bustereq1:78.5.0-1~deb10u1
thunderbird:bustereq1:68.12.0-1~deb10u1
thunderbird:bustereq1:60.9.0-1~deb10u1
thunderbird:bustereq1:78.6.0-1~deb10u1
thunderbird:sideq1:78.5.0-1
thunderbird:bullseyeeq1:78.5.0-1
thunderbird:bustereq1:78.5.0-1~deb10u1
thunderbird:bustereq1:68.12.0-1~deb10u1

Name	Operator	Version
thunderbird:sid	eq	1:78.5.0-1
thunderbird:bullseye	eq	1:78.5.0-1
thunderbird:buster	eq	1:78.5.0-1~deb10u1
thunderbird:buster	eq	1:68.12.0-1~deb10u1
thunderbird:buster	eq	1:60.9.0-1~deb10u1
thunderbird:buster	eq	1:78.6.0-1~deb10u1
thunderbird:sid	eq	1:78.5.0-1
thunderbird:bullseye	eq	1:78.5.0-1
thunderbird:buster	eq	1:78.5.0-1~deb10u1
thunderbird:buster	eq	1:68.12.0-1~deb10u1